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No  matter  what  job  you're  doing  as  an 
Airman,  you're  using  cyberspace  every  day. 
Without  it,  you  couldn't  do  your  job. 


Lt  Gen  Robert  Elder,  8  AF  Commander 


The  United  States  military  is  heavily  reliant  on  technology 
to  fight  and  win.  Much  of  this  technology  relies  on  cyberspace. 
The  National  Strategy  to  Secure  Cyberspace  and  the  National 
Military  Strategy  for  Cyberspace  Operations  were  written  to 
address  this  growing  reliance  on  cyberspace  and  to  guide  the 
armed  services  in  developing  their  own  doctrine.  In  response, 
the  Air  Force  changed  its  mission  statement  to  include  flying 
and  fighting  in  cyberspace  and  began  codifying  its  cyberwarfare 
doctrine.  This  effort  is  hampered,  however,  by  a  limited 
understanding  of  cyberspace  by  rank  and  file  Air  Force  members. 
Many  believe  cyberspace  and  cyberwarfare  are  the  responsibility 
of  the  communications  community.  If  this  new  doctrine  is  to  be 
relevant,  it  must  form  a  clear  and  direct  link1  between 
cyberspace  and  the  Air  Force's  key  operational  functions . 2  By 
using  existing  joint  and  service  doctrine3  to  build  upon,  the  Air 
Force  can  create  unity  of  effort  among  Airmen  at  all  levels, 
ensure  unity  of  purpose  in  the  prosecution  of  cyber  warfare,  and 
clearly  delineate  where  military  responsibility  for  cyberspace 
ends  and  non-military  responsibility  begins. 

Background 

Air  Force  cyberspace  doctrine  development  is  based  upon 
DOD' s  2006  definition  of  cyberspace,  which  states,  "cyberspace 
is  a  domain  characterized  by  the  use  of  electronics  and  the 
electromagnetic  spectrum  to  store,  modify,  and  exchange  data  via 


networked  systems  and  associated  physical  infrastructure."4  The 
Air  Force  refined  this  further  to  "cover  everything  from 
satellite  communication  to  gamma  rays  to  microwave 
technologies."5  The  cyberspace  domain  impacts  nearly  everything 
the  military  services  do.  This  new  domain  is  unlike  the  land, 
sea,  and  air  domains,  however,  because  it  has  no  boundaries  and 
cuts  across  all  other  domains.  These  distinctions  make  it 
conceptually  difficult  to  understand  and  operationalize. 

Creating  Unity  of  Effort 

The  Air  Force,  Army,  and  Marine  Corps  have  spent 
considerable  time  re-evaluating  and  developing  updated 
counterinsurgency  (COIN)  doctrine  within  the  last  two  years.6 
The  insights  developed  from  these  efforts  should  be  applied  to 
developing  cyberspace  doctrine  because  cyberspace  and  COIN 
operations  have  many  similarities.  For  example,  tracking  down  a 
specific  individual  to  hold  responsible  for  attacks  in  either 
environment  is  nearly  impossible.  Additionally,  attacks  are 
often  distributed  and  numerous  groups  or  factions  can  attack  at 
the  same  time.  The  cyberspace  and  COIN  environments  are  both 
constantly  changing  and  adapting  as  well.  Finally,  attacks  are 
rarely  an  end  in  themselves  for  attackers.  Even  when  attacks 
are  soundly  defeated,  the  attackers  may  still  accomplish  their 
strategic  or  operational  goals.  One  of  the  biggest  challenges 
to  developing  counterinsurgency  doctrine  is  addressing  how 
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forces  trained  to  produce  kinetic  effects  can  fight  and  win  a 
primarily  non-kinetic  fight.  This  is  the  same  major  dilemma  in 
cyber  warfare.7 

Numerous  differences  also  exist  between  cyberspace  and  COIN 
operations.  For  example,  most  insurgencies  are  politically 
motivated,  while  motivations  for  cyber  attacks  can  range  from 
criminal  intent  to  national  intelligence  gathering.8  The  obvious 
differences9,  however,  do  diminish  the  usefulness  of  COIN 
doctrine  as  a  framework  to  focus  development  efforts.  A  correct 
focus  will  create  unity  of  effort  across  the  Air  Force  by 
ensuring  personnel  understand  how  their  efforts  combine  to  help 
the  Air  Force  fight  and  win  in  cyberspace.  This  focus  will  also 
provide  a  second-order  effect  of  unifying  the  public  affairs 
effort  surrounding  cyberspace,  which  reinforces  a  growing 
culture  of  "cyberminded"  warriors  throughout  the  Air  Force.10  As 
this  new  culture  develops,  the  Air  Force  will  begin  to  benefit 
from  a  combined,  unified  effort  of  all  Airmen  to  combat  and 
prosecute  cyber  warfare. 

Providing  Unity  of  Purpose 

Cyberspace  doctrine  must  also  integrate  with  and  supplement 
other  Air  Force  doctrine.  This  integration  will  be  difficult 
because  the  DOD  and  Air  Force  definitions  of  cyberspace, 
electronic  attack,  electronic  protection,  and  computer  network 
operations  are  all  considered  part  of  cyberspace  operations. 
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Current  doctrine  also  places  all  of  these  capabilities  into  the 
information  operations  realm  as  well.11  This  apparent  conflict 
exists  because  information  operations  involve  protecting  and 
disseminating  information,  while  cyberspace  operations  are 
responsible  for  protecting  and  managing  the  systems  and 
transmission  paths  information  traverses.  These  similarities 
cause  confusion  and  hinder  the  average  Airman' s  ability  to 
understand  where  they  fit  into  the  picture  or  what  they  are 
supposed  to  do  to  help  support  the  Air  Force's  efforts. 

Integration  with  current  doctrine  and  a  focus  on 
warfighting  will  ensure  effective  use  of  our  nascent  cyber 
attack  capability.  Currently,  the  Air  Force's  attack  capability 
is  limited  by  several  factors.  First,  the  United  States 
recognizes  cyber  attacks  as  acts  of  war.  Consequently,  any  such 
acts  require  the  highest  levels  of  political  approval  before 
they  can  be  carried  out. i_  Further,  the  Air  Force  has  very  few 
operators  that  possess  the  specialized  knowledge  and  skills  to 
perform  attacks.  Finally,  the  services  do  not  possess  the  level 
of  intelligence  or  the  capability  to  gather  the  level  of 
intelligence  required  to  execute  anything  but  the  most 
rudimentary  attacks . lj  By  integrating  cyberspace  doctrine  with 
special  operations  and  intelligence  doctrine,  the  Air  Force  will 
ensure  proper  levels  of  training  and  resources  are  dedicated  to 
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cyberspace  and  cyber  warfare  efforts,  which  will  provide  unity 
of  purpose  across  all  functional  areas. 

As  demonstrated,  cyberspace  doctrine  touches  nearly  every 
functional  area  and  aspect  of  air  and  space  doctrine.  These 
interconnections  must  be  documented  and  addressed  throughout  the 
Air  Force  and  across  DOD  to  minimize  confusion  and  maximize 
effectiveness.  If  this  development  effort  falls  short,  the 
American  "Way  of  War"  will  find  itself  increasingly  plagued  by 
cyberspace-enabled  challenges  because  of  the  American  tendency 
to  underemphasize  alternative  belief  systems,  culture [s],  and 
revolution [ s ]. 14  FM  3-24/ MCWP  3-33.5  argues,  "the  forces  that 
successfully  defeat  insurgencies  are  usually  those  able  to 
overcome  their  institutional  inclination  to  wage  conventional 
war".15  Applying  this  premise  to  cyberspace  doctrine  ensures  the 
doctrine  will  unify  not  only  Air  Force  efforts,  but  also  help 
all  of  DOD' s  cyber  efforts. 

Providing  Clear  Political  Boundaries 

Enduring  principles  are  what  set  the  military  services 
apart  from  civilian  and  other  governmental  organizations.  For 
example,  unity  of  effort  in  military  operations  ensures  maximum 
effects  are  directed  toward  the  main  effort  while  expending 
minimum  effort  on  non-essential  tasks.  Combining  unity  of 
effort  with  the  COIN  principle  of  understanding  the  environment 16 
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will  help  delineate  natural  boundaries  between  the  myriad  of 
agencies  responsible  for  securing  cyberspace. 

Understanding  the  environment  in  context  of  this  discussion 
means  understanding  which  agencies  have  been  tasked  with 
securing  which  pieces  of  cyberspace.  The  National  Strategy  for 
Homeland  Security  delineates  this  as  outlined  in  the  table  in 
Appendix  1 . 17  This  framework  allows  agencies  to  benchmark  their 
cyberspace  efforts  against  their  operations  in  other  domains  to 
develop  effective,  workable  action  plans.  Most  of  these 
agencies  do  not  coordinate  their  efforts  across  the  government, 
however,  so  projects  that  benefit  one  department  or  agency  can 
conflict  with  efforts  in  another. 

This  confusion  is  magnified  when  agencies  try  to  work  with 
the  DOD  because  few  truly  understand  where  military 
responsibility  for  cyberspace  begins  and  ends.  The  Air  Force 
should  use  its  cyberspace  doctrine  to  recommend  models  of  how 
and  where  these  lines  of  responsibility  should  be  drawn.  The 
service  could,  for  example,  base  the  lines  on  how  the  Federal 
Aviation  Administration  and  military  work  together  to  protect 
and  organize  the  air  domain.  They  could  also  use  how  the  Navy 
and  Coast  Guard  combine  to  protect  the  nation's  coasts,  ports, 
and  waterways  as  a  benchmark  for  the  effort.  By  recommending 
lines  the  Air  Force  is  comfortable  with,  they  can  drive  the 
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discussion  rather  than  wait  for  the  fallout  when  a  civilian 
agency  or  commission  decides  for  them. 

Counterarguments 

When  developing  new  doctrine,  one  of  the  fundamental 
decisions  to  be  made  is  who  is  going  to  be  responsible  for 
driving  doctrine  development.  Due  to  the  misperception 
discussed  previously,  many  in  the  rank  and  file  Air  Force  would 
relegate  this  effort  to  the  communications  community.  When  Air 
Force  senior  leadership  decided  to  align  the  new  Cyber  Command 
with  Eighth  Air  Force,  they  demonstrated  their  belief  that 
cyberspace  effects  belong  in  the  operational  realm,  however. 
Placing  the  operational  community  in  charge  of  cyberspace 
ensures  doctrine  integrates  with  air  and  space  doctrine  to 
produce  unity  of  effort  and  continuity  across  all  Air  Force 
domains . 

Others  also  argue  that  COIN  doctrine  cannot  be  applied  to 
cyber  warfare  because  COIN  operations  are  primarily  about 
"winning  the  hearts  and  minds"  of  civilians  in  the  operations 
area.  They  consider  this  goal  impossible  in  cyberspace  because 
no  equivalent  to  a  civilian  population  exists.  This  argument 
makes  COIN  operations  too  simplistic,  however.  COIN  doctrine 
states  that  military  forces  should  use  whatever  combination  of 
efforts  (kinetic  and  non-kinetic)  they  can  to  change  the  local 
environment  on  a  fundamental  level.  COIN  operations  begin  by 
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providing  physical  security  and  then  systematically  working  with 
community  leaders  to  bring  about  changes  that  make  sense  in  that 
local  area.  This  same  model  can  easily  be  applied  to 
cyberspace.  The  objective  is  not  to  "win  the  hearts  and  minds." 
Rather,  it  is  to  combine  effects  in  ways  that  make  sense  based 
on  the  local  environment  to  achieve  the  desired  end  state. 
Properly  integrated  cyberspace  doctrine  will  provide  the  basis 
for  the  combination  of  efforts  to  happen. 

Conclusion 

One  of  the  biggest  hurdles  the  Air  Force  must  overcome 
while  developing  cyberspace  doctrine  is  the  idea  that 
cyberwarfare  is  about  anything  other  than  warfare.  Naming  a  new 
domain  has  not  changed  the  fundamental  nature  of  war.18  New 
doctrine  must  augment  current  doctrine  and  improve  the  Air 
Force's  ability  to  fight  in  air,  space,  and  cyberspace  rather 
than  confuse  and  diffuse  its  forces.  Refocusing  doctrine 
development  on  warfighting  functions  and  using  established 
doctrine  documents  like  AFDD  2-3  and  FM  3-24/MCWP  3-33.5  will 
ensure  the  Air  Force  has  meaningful,  relevant  cyberspace 
doctrine  that  is  understandable  and  usable. 
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Appendix  1 


Table  1 .  Critical  Infrastructure  Sectors  with  Lead  Agency 


Sector 

Lead  Agency 

Agriculture 

Department  of 

Agriculture 

Food 

Meat  and  poultry:  Department  of  Agriculture 

All  other  food  products:  Department  of 

Health  &  Human  Services 

Water 

Environmental 

Protection  Agency 

Public  Health 

Department  of 

Health  &  Human  Services 

Emergency  Services 

Department  of 

Homeland  Security  (DHS) 

Government 

Continuity  of 

government:  DHS 

Continuity  of 
and  agencies 

operations:  all  departments 

Defense  Industrial  Base 

DOD 

Information  and 

Telecommunications 

DHS 

Energy 

Department  of 

Energy 

Transportation 

DHS 

Banking  and  Finance 

Department  of 

the  Treasury 

Chemical  Industry 

Environmental 

Protection  Agency 

Postal  and  Shipping 

DHS 

National  Monuments  and 

Icons 

Department  of 

the  Interior 
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